I use Windows 8.1 Pro 64 bit and IE11. I have two personal certificates (with private key) of mine in the system certificate store. They are both set to require a password before they can be used.
This worked until a few days ago. Then I noticed that one of them is accessible without a password. How could that happen?
What I normally do is:
- I open a HTTPS website that requires certificate auth
- the dialog pops up to select a certificate (only one is offered, based on the CA, each of my certs are from different CAs)
- after I select it, another system dialog appears, asking to grant or deny access to the certificate and for granting, I must enter the password
- after entering the correct password, the website loads
This worked like this for both of the certificates (each used on a different website). But recently, one certificate does not require the password any more. I can just select it and use it to access the website. The other still requires the password.
To check my memory is not playing tricks with me, I restored a system image backup a few month old. It has Windows 8 Pro and IE10. There both certificates ask for a password. (I upgraded that system to Windows 8.1 via the Windows Store).
I don't see a way to change the security level of certificates after they are imported, so I did not do it myself and the forget about it.
I can re-import the certificate and set a password for it, but the question is, how did this happen? I checked the PC for malware (booting from a USB key: HBCD and Ubuntu) and found nothing.